CVE-2026-52754: Ghidra < 12.1 - Authentication Bypass via Null Signature in PKIAuthenticationModule

Synopsis

Authentication bypass in Ghidra's PKIAuthenticationModule allows any authenticated user to impersonate arbitrary other users by presenting a CA-signed certificate with a null signature. The vulnerability is reachable over the network and requires only a low-privilege account (a valid CA-signed certificate) to exploit. Successful exploitation gives an attacker full control over other users' sessions, enabling privilege escalation, repository access control modification, and exfiltration of shared reverse engineering databases. A patched-image rebuild at version 12.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Ghidra server over the network; the vulnerability is exposed via a network-accessible service endpoint.

• AuthenticationRequired

  The attacker must hold a low-privilege account in the form of any valid CA-signed certificate, though no admin access is needed.

• Victim interactionNot required

  No victim interaction is required; the attacker submits the malformed null-signature certificate directly to the server without any user action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond holding a valid certificate.

Blast Radius

• Reads all shared reverse engineering databases and project artifacts stored on the Ghidra server, including proprietary binary analysis data.
• Modifies repository access controls, granting or revoking permissions for any user or project on the server.
• Escalates to administrative privileges by impersonating higher-privileged users, enabling persistent unauthorized administrative access.
• Permanently compromises server integrity by altering stored analysis data, user configurations, or access policies in ways that survive the session.